Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Dark Avenger

Dark Avenger.1800

The classical Dark Avenger is an 1800 bytes long COM an EXE infector. It is considered to be a fast virus because it infects programs not only when they are executed, but also when they are opened, closed and created, or when attributes are changed. The virus identifies infected files according to the value of seconds at the time of origin which is set to 62. That value is used also by other variants of the virus. In the body there are two interesting strings:

Eddie lives...somewhere in time! This program was written in the city of Sofia (C) 1988-89 Dark Avenger

The virus is destructive, but the caused damage is inconspicuous. Depending on the value of the counter in boot sector it deletes a random sector on the disc. The chosen sector may be empty but if it contains any data its contents are irretrievable destroyed.

Dark Avenger.2000

It randomly erases sectors on the disc in the same way as the 1800 bytes long variant does. The length of exactly 2000 bytes is a suitable masking measure because hardly anybody notices such an increase of a file at a glance. With the DOS command DIR the increase in length is not visible. At the end of the virus the following text can be seen:

(C) 1989 by Vesselin Bontchev

Dark Avenger.2100

Destruction in the form of erasing random disc sectors takes place also in this variant. A novelty, when compared to the previous viruses is that this virus masks the increased length of infected files not only with the command DIR but also with use of utilities of Norton Commander type. At the end of the virus there is the copyright known from the previous version, only the year is changed to 1990. There are many viruses inspired by Dark Avenger, source texts were rather widespread. Dark Avenger is also author of other, not less interesting viruses as Commander Bomber , polymorphic library MtE etc.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.